From 5f8e1a014f56f88958cf6f4788b18c0c6e286b72 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 5 Nov 2019 22:03:19 +0100 Subject: [PATCH] avformat/vividas: Error out on audio packets in the absence of audio streams Signed-off-by: Michael Niedermayer (cherry picked from commit d83002179fb377f1f201b43c9a55cc237695a1fe) Signed-off-by: Michael Niedermayer --- libavformat/vividas.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/libavformat/vividas.c b/libavformat/vividas.c index bf19b55f51..f20af3d7c2 100644 --- a/libavformat/vividas.c +++ b/libavformat/vividas.c @@ -52,6 +52,7 @@ typedef struct VIV_AudioSubpacket { typedef struct VividasDemuxContext { int n_sb_blocks; VIV_SB_block *sb_blocks; + int num_audio; uint32_t sb_key; int64_t sb_offset; @@ -280,7 +281,7 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t * int i,j; int64_t off; int val_1; - int num_video, num_audio; + int num_video; AVIOContext *pb; pb = avio_alloc_context(buf, size, 0, NULL, NULL, NULL, NULL); @@ -342,13 +343,13 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t * off = avio_tell(pb); off += ffio_read_varlen(pb); // val_10 avio_r8(pb); // '4' - num_audio = avio_r8(pb); + viv->num_audio = avio_r8(pb); avio_seek(pb, off, SEEK_SET); - if (num_audio != 1) - av_log(s, AV_LOG_WARNING, "number of audio tracks %d is not 1\n", num_audio); + if (viv->num_audio != 1) + av_log(s, AV_LOG_WARNING, "number of audio tracks %d is not 1\n", viv->num_audio); - for(i=0;inum_audio;i++) { int q; AVStream *st = avformat_new_stream(s, NULL); @@ -678,6 +679,9 @@ static int viv_read_packet(AVFormatContext *s, if (viv->sb_entries[viv->current_sb_entry].flag == 0) { uint64_t v_size = ffio_read_varlen(pb); + if (!viv->num_audio) + return AVERROR_INVALIDDATA; + ffio_read_varlen(pb); if (v_size > INT_MAX) return AVERROR_INVALIDDATA;